Firewall for AI & LLMs

What It Is

AI Security for Apps extends the Cloudflare WAF with detections specifically designed for LLM-powered applications. It is model-agnostic — it works regardless of which LLM you use (OpenAI, Anthropic, Google Gemini, Workers AI, self-hosted, etc.).

It is complemented by AI Gateway, a proxy layer (available on all plans) that adds Guardrails, DLP, rate limiting, caching, and full prompt/response logging between your app and the LLM provider.

Plan Availability

Architecture & Traffic Flow

Cloudflare's AI security is a layered stack. Requests pass through WAF-level LLM detection first, then optionally through AI Gateway before reaching the LLM provider.

LLM Endpoint Discovery

Cloudflare automatically detects LLM endpoints using traffic heuristics — no manual configuration required. Once detected, endpoints are labeled cf-llm via API Shield, enabling filtering in Security Analytics and scoping of WAF rules.

How Heuristics Work

PII Detection

Two complementary approaches that can be combined for layered protection:

Fuzzy Detection (AI-powered)

Uses Microsoft Presidio to detect PII even in natural language or unexpected formats. Supports 40+ categories:

Exact Detection (Regex)

Use WAF custom rules with http.request.body.raw matches "PATTERN" for organization-specific formats:

Prompt Injection Detection

Score-based system using the cf.llm.prompt.injection_score field. Range: 1–99. Lower score = higher injection risk.

A score-based approach is used rather than a binary result because injection exists on a spectrum. A creative writing request may superficially resemble an injection attempt without actually being one.

Unsafe & Custom Topic Detection

Predefined Unsafe Topics (14 categories)

curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/firewall-for-ai/custom_topics" \
  --request PUT \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  --json '{
    "topics": [
      { "label": "competitors", "topic": "asking about competitor products and pricing" },
      { "label": "legal-advice", "topic": "asking for legal counsel or regulatory guidance" },
      { "label": "hr-internal", "topic": "internal HR policies and employee matters" }
    ]
  }'

Detection Fields Reference

These fields are populated by AI Security for Apps on requests hitting cf-llm labeled endpoints and can be used in WAF Custom Rules and Rate Limiting Rules.

Log Mode vs Production Mode

Enable Log Mode via API

curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/rulesets/phases/http_request_firewall_managed/entrypoint" \
  --request PUT \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  --json '{
    "rules": [{
      "action": "execute",
      "action_parameters": { "id": "b7cd52df92f74c848cec0c2ed385e336" },
      "expression": "true"
    }]
  }'

Enable via Dashboard

Security > Settings > AI Security for Apps > Managed Ruleset > Enable
Action: Log
Configure payload logging to allow decryption of prompts in Security Analytics

Setup Steps — AI Security for Apps (WAF)

1. Enable AI Security for Apps Dashboard: Security > Settings > filter by "Detection tools" > Toggle AI Security for Apps On.
   
   Or via API:

   curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/firewall-for-ai/settings" \
     --request PUT \
     --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
     --json '{ "pii_detection_enabled": true }'

2. Label LLM endpoints with cf-llm Auto-discovery handles this in most cases. To manually apply: Security > Web Assets > Endpoints > Edit endpoint labels > cf-llm.
3. Enable the AI Security Log Mode Ruleset Turn on with action = Log. Enable payload logging so you can decrypt and read actual prompts in Security Analytics.
4. Review detections in Security Analytics Filter by the cf-llm label. Decrypt payloads. Note injection scores, PII categories, and unsafe topic rates across your traffic baseline.
5. Define custom topics (if needed) Use the dashboard or API to define up to 20 custom topics. Use verb-phrase topic strings for best precision.
6. Build production custom rules Create WAF Custom Rules using cf.llm.* fields with tuned thresholds. Start with Log action to validate before blocking.
7. Switch to Block and iterate Once rules are validated, change actions to Block. Monitor continuously and adjust thresholds as traffic patterns evolve.

Example WAF Rules

Block High-Confidence Prompt Injection

(cf.llm.prompt.injection_score lt 20)

Challenge Moderate-Risk Injection

(cf.llm.prompt.injection_score lt 40)

Block Specific PII Categories Only

(any(cf.llm.prompt.pii_categories[*] in {"CREDIT_CARD" "US_SSN"}))

Log Emails — Block Credit Cards and SSNs

Rule 1 — Block:

(any(cf.llm.prompt.pii_categories[*] in {"CREDIT_CARD" "US_SSN"}))

Rule 2 — Log:

(any(cf.llm.prompt.pii_categories[*] in {"EMAIL_ADDRESS"}))

Block Specific Unsafe Topics

(any(cf.llm.prompt.unsafe_topic_categories[*] in {"S1" "S10"}))

Layered — Injection + Bot Score + Geo (Low False Positives)

(cf.llm.prompt.injection_score lt 25
  and cf.bot_management.score lt 10
  and ip.geoip.country ne "US")

Block Injection from Automated Sources

(cf.llm.prompt.injection_score lt 30 and cf.bot_management.score lt 20)

Combined — Injection + PII (Common Attack Pattern)

(cf.llm.prompt.injection_score lt 40 and cf.llm.prompt.pii_detected)

Block Custom Topic (Competitors)

(cf.llm.prompt.custom_topic_categories["competitors"] lt 30)

Scope Rule to Specific Endpoint + Custom PII Format

(http.request.uri.path eq "/api/chat"
  and http.request.body.raw matches "EMP-[0-9]{6}")

Rate Limit High-Token Prompts (Cost Control)

(cf.llm.prompt.token_count gt 2000
  and http.request.uri.path eq "/api/chat")

Allow Financial PII Only from Internal Network

(cf.llm.pii.detected eq true
  and not ip.src in {10.0.0.0/8 172.16.0.0/12 192.168.0.0/16})

AI Gateway — Complementary Security Layer

AI Gateway is available on all Cloudflare plans at no cost. It sits between your app and LLM providers, adding security, observability, and performance features that the WAF layer cannot provide (e.g., response scanning, caching, model fallback).

AI Gateway — Guardrails

Guardrails intercept and evaluate both user prompts and model responses for harmful content before they reach the user or LLM. The feature works as a proxy between your application and model providers.

Configuration Options

Setup Steps

1. Dashboard → AI → AI Gateway → select your gateway → Settings
2. Enable Guardrails
3. Set evaluation scope: user prompts, model responses, or both
4. Select hazard categories to monitor and set action per category (block or flag)

AI Gateway — Data Loss Prevention (DLP)

AI Gateway DLP uses the same detection engine as Cloudflare's enterprise DLP product to scan AI traffic in real-time. It scans both incoming prompts and outgoing model responses.

DLP Detection Categories

AI Gateway — Setup

Create a Gateway

1. Dashboard → AI → AI Gateway → Create Gateway
2. Name your gateway (64 character limit)
3. Connect your application by routing AI provider calls through the gateway URL
4. Configure settings: Authentication, Rate Limiting, Caching, Guardrails, DLP

Enable DLP

1. Select your gateway → Firewall tab
2. Toggle Data Loss Prevention (DLP) to On
3. Add DLP policies — select detection entries and set action (block / log)

Enable Rate Limiting

1. Select your gateway → Settings
2. Enable Rate-limiting
3. Set rate, time period, and strategy (fixed window or sliding window)

Enable Caching

1. Select your gateway → Settings
2. Enable Cache Responses
3. Set default cache TTL. Override per-request by passing cf-aig-cache-ttl header

OWASP Top 10 for LLMs — Coverage Map

Recommended Deployment Workflow

Optimization Best Practices

Security

Cost & Performance

Operational Visibility

Documentation Links